WebERP SQL Injection Vulnerability in StockCounts.php

A SQL injection vulnerability has been identified in WebERP version 4.15.2. This vulnerability allows attackers to execute arbitrary SQL commands and extract sensitive data. The issue arises in the StockCounts.php file, where a crafted payload can be injected into the DEL form field via a POST request.

Impact

Exploitation of this vulnerability allows for error-based SQL injection, where an attacker can manipulate SQL queries and potentially access or modify database information.

Reproduction

To reproduce this vulnerability, authenticate as an Accountant user and navigate to the StockCounts.php page. Intercept the request to delete a stock count entry and inject a SQL payload into the DEL parameter. Once the request is sent, the injected SQL command will be executed, and the response can be used to extract database information, such as table names.

Remediation

Users can update to the patched version of WebERP, which is available on the project's GitHub releases page.